Neomano Binance Assets (Read-only)

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:26 AM UTC
• Version: 0.1.2

Overview

This skill transparently uses Binance read-only API credentials to show Spot balances and does not contain hidden persistence, trading, withdrawal, or unrelated behavior.

Install only if you are comfortable giving the skill access to read Binance Spot account balances. Use a Binance API key with reading only, no trading or withdrawal permissions, and an IP allowlist if available; treat the printed balances as sensitive financial information.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill requires sensitive environment variables and makes outbound network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens policy enforcement and reviewability because the runtime capabilities are broader than what is formally documented in the skill manifest.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

This skill is designed to be a **safe way to query balances**.

- **READ-ONLY keys only**: In Binance, create an API key with **Read-only / Enable Reading** permissions.
- Do **not** enable trading, margin, futures, transfers, or withdrawals.
- (Recommended) Restrict the API key by **IP allowlist**.
- Never print or send `BINANCE_API_SECRET`.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

## What it does

- Fetch Spot account balances via Binance signed endpoint:
  - `GET https://api.binance.com/api/v3/account`
- By default, it filters to **non-zero** assets.

## Run

Static analysis

No suspicious patterns detected.